9.4 BioLine Privacy Statement

This Privacy Statement explains the types of data and information we collect when you use the BioLine platform (the AI upgrade of the FLOWHUB Platform / 碳觅云析), how we collect and use it, and how you can control our processing. We process your personal information in accordance with the Personal Information Protection Law, the Data Security Law, the Cybersecurity Law, and other applicable laws. Accessing or using the BioLine platform means you have read and agreed to this statement.

1. What Data We Collect

1.1 Submitted data. You may provide various types of data, including genetic sequencing data, such as FASTQ/gz files, abundance tables, and metabolomic tables, along with related identifiers, medical phenotypes, grouping, or special-field descriptions relevant to the analysis.

1.2 Payment information. To pay for services, you may need to submit payment information such as billing information and third-party payment-account information.

1.3 Account information. During or after registration, we may ask you to provide true contact information such as an email address. Your account may be linked to others through mechanisms such as project permissions.

1.4 Activity information. When you use our services, we keep activity logs such as pages visited, task start times, and API-call records.

1.5 Data from interacting with the AI agent. When you use AI capabilities such as AI conversation, quick tasks, and literature interpretation, we process the instructions (prompts) you input, the conversation context, the selected model, the file paths involved, and necessary metadata, to generate replies and improve the service. To protect your interests, we do not transmit your raw sequencing data to large models; please also do not proactively input sensitive personal information or data that may not be processed by law into conversations.

1.6 Other and market information. You may provide other information by communicating with the support team or submitting feedback; to better understand user interests and improve products, we may collect limited information about users or potential users (for example, matching users from the same institution).

2. How We Use This Data

We store and process submitted data on your behalf, for example when you run flows or use the AI agent to orchestrate analysis. To support you, we may access and process relevant data as necessary (for example, debugging failed tasks). Data is processed and stored on servers provided by qualified third-party service providers, encrypted throughout. We use payment information only to charge you; use account information to contact you about service-related matters (for example, task-completion notices); and use activity and device information to stabilise, improve, and better understand your use of the services. If you make explicit choices about data permissions, we may share relevant data and certain account-information elements with users you allow to join your projects. Except with your consent or as required by law, we will not use your data for purposes not mentioned in this statement.

3. How We Share and Entrust Processing

3.1 Entrusted processing. We share necessary information with a limited number of service providers who have signed data-protection agreements, to perform payment processing, customer support, network data transfer, security, cloud computing, and cloud storage; they must observe privacy restrictions similar to this statement. 3.2 Third-party large-model providers. When you invoke a third-party model, we may transmit the instructions and metadata necessary to complete the task (excluding raw sequencing data) to the corresponding provider within the minimum necessary scope. 3.3 Legally required disclosure. To comply with legal process or obligations, we may disclose relevant information pursuant to a valid subpoena, court order, or government order, and will make reasonable efforts to notify you where permitted. 3.4 Change of control. In a merger, sale, or acquisition, we may transfer user information, but the recipient must observe the commitments of this statement, and we will notify you via the website or email before transfer. We do not sell your personal information for money or other consideration.

4. Your Control Over Data

After logging in, you may access and edit most elements of your account information via the personal centre by clicking your avatar, and view your related data via the navigation bar. You may control which users can access your projects, setting permissions for participants such as upload, view, modify, share, run tasks, and manage projects (note that allowing a user to manage a project may let them grant themselves further permissions). You may also access and delete your submitted data in the project's Files section. Under the Personal Information Protection Law, you have rights to access, copy, correct, supplement, delete, withdraw consent, and deregister your account regarding your personal information. To further access, correct, or delete the information we hold, or to exercise these rights, contact us at flowhub_team@flowhub.com.cn, and we will make reasonable efforts to meet such requests.

5. AI Agent and Personal-Information Protection

In providing AI-agent services, we follow the principles of lawfulness, propriety, necessity, and good faith, and adhere to minimum-necessary processing: we process only the information necessary to complete the AI task; we do not transmit raw sequencing data to large models; and we may use data produced during interactions for service improvement and statistics only after applying de-identification and other protective measures. AI-generated content is for reference only and does not constitute professional, medical, or diagnostic advice. You may decline or stop using AI capabilities without affecting your use of other platform functions.

6. Protection of Minors

The services are primarily intended for general users engaged in research and are not designed for minors. If you are a minor, please use the services accompanied by and with the consent of your legal guardian. We do not actively collect minors' personal information; if we find we have collected a minor's personal information without guardian consent, we will endeavour to delete it promptly.

7. Data Storage, Cross-Border Transfer, and Security

We store the personal information we collect within the People's Republic of China. Where cross-border provision is genuinely necessary, we will fulfil the applicable security assessment, certification, or standard-contract procedures under the Personal Information Protection Law and the Measures for Security Assessment of Cross-Border Data Transfer, and obtain your separate consent where applicable. Where human genetic-resource information is involved, the requirements of the Regulations on the Administration of Human Genetic Resources also apply. We protect your information through encrypted transmission and storage, access control, and audit logging; see BioLine Data Use and Protection and BioLine Supplementary Regulations for Data Protection in this chapter.

8. More Information

8.1 Third-party links. The platform's website and services may contain links to sites and services maintained by third parties, to which this statement does not apply and which may have different processing rules. 8.2 Questions and complaints. For any questions, comments, or complaints about this statement or the processing of your personal information, contact us at flowhub_team@flowhub.com.cn. 8.3 Changes to this statement. We may periodically update this statement and publish changes on the platform, notifying you by email or other means where necessary; please review it in a timely manner.